kube-score vs Test Kitchen

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.

Test Kitchen is a free test harness for running infrastructure code in isolation on one or more platforms. Its workflow uses create, converge, setup, verify, and destroy commands to provision environments and test infrastructure code. Documented drivers cover Amazon EC2, Apache CloudStack, DigitalOcean, Docker through Dokken, Google Cloud Platform, Hetzner Cloud, Vagrant, Azure, Hyper-V, OpenStack, and VMware products. Which drivers are available depends on the driver gems installed in the Ruby environment. Provisioning options include Chef Infra, Cinc Client, Habitat, PowerShell DSC, and shell scripts; listed verification integrations include Cinc Auditor, Chef InSpec, and Serverspec. Community plugins add Ansible, Puppet, and Salt provisioners. Installation is available through RubyGems, system packages, or Cinc Workstation, but Test Kitchen itself does not bundle Cinc or Chef tooling. Requirements include a 64-bit operating system and enabled CPU virtualization. The project uses Apache License 2.0 and points users to Chef Community Slack for community assistance. The documentation notes known issues and no current maintainer for kitchen-docker, recommending kitchen-dokken instead.